Human operators use mental models to guide their interaction with automated systems. We can ``model the human'' by constructing explicit descriptions of plausible mental models. Using mechanized formal methods, we can then calculate divergences between the actual system behavior and that suggested by the mental model. These divergences indicate possible automation surprises and other human factors problems and suggest places where the design should be improved.